CVE-2026-77401

Zope's str.format subclass bypasses security, leaking objects via getattr

• CVSS 6.8
• 693
• Information Leakage
• Remote

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.

CVE

CVE-2026-77401

CWE

693

CVSS base score

6.8

Published

2026-09-16

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Zope

Fixed by upgrading

Yes

Solution

Upgrade Zope AccessControl to version 7.4 or later.

from AccessControl import getSecurityManager
def render_template(template, mapping):
    # VULNERABLE: built‑in format uses unrestricted getattr/getitem
    return template.format(**mapping)

from AccessControl import getSecurityManager
from AccessControl.safe_str import SafeString
def render_template(template, mapping):
    # FIX: SafeString.format enforces restricted attribute/item access
    safe_tpl = SafeString(template)
    return safe_tpl.format(**mapping)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202677401,
  title        = {{Zope's str.format subclass bypasses security, leaking objects via getattr}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-77401},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-77401/}}
}